Class KnownHostsVerifier

Verifies host keys against OpenSSH known_hosts files, with StrictHostKeyChecking semantics:

A recorded key that matches is trusted; one listed as @revoked is always refused.
A different key of a recorded type ("the host key has changed") is refused, except with No.
An unknown key is refused (Yes), offered to AskHostKey, or recorded and trusted (AcceptNew, No). AcceptNew refuses it when keys of other types are already recorded for the host, so a man in the middle cannot get a weaker key type accepted silently.

New keys are appended to the first user file. The file is rewritten only by UpdateHostKeys, to remove keys the server no longer announces.

public sealed class KnownHostsVerifier : SshHostKeyVerifier

Inherited Members: SshHostKeyVerifier.FromDelegate(Func<SshHostKeyContext, CancellationToken, ValueTask<bool>>)

SshHostKeyVerifier.Pinned(params string[])

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

KnownHostsVerifier(IReadOnlyList<string>, IReadOnlyList<string>?): Creates a verifier.

AskHostKey: Asks the user whether to trust an unknown key in Ask mode; true trusts and records it. Without it, Ask behaves like Yes.

ConfirmHostKeyUpdate: Asked before known_hosts is changed by UpdateHostKeys (ssh's UpdateHostKeys ask): return true to apply the update. Without it, updates are applied without asking (UpdateHostKeys yes).

HashNewEntries: Record new hosts hashed (|1|salt|hash), like HashKnownHosts yes.

Policy: How unknown and changed keys are handled. Default Ask, as in OpenSSH.

RevokedHostKeys: A file of host keys never to accept, as RevokedHostKeys in ssh_config: an OpenSSH Key Revocation List (ssh-keygen -k), or a list of public keys, one per line. A revoked key is refused whatever known_hosts says, and so is a host certificate whose key, authority, serial number or key id is revoked. As with ssh, a file that cannot be read or is a malformed KRL refuses every host key: a revocation list that cannot be checked must not let a revoked key through. A KRL's signatures are not verified.

UpdateHostKeys: Keep known_hosts in step with the host keys a server announces after authentication (OpenSSH's UpdateHostKeys): new keys are added once the server has proven it holds them, and this host's keys it no longer announces are removed. This lets a server rotate its keys without users seeing "host key changed". Only the first user file changes, only lines for exactly this host (not wildcard lines, not @cert-authority or @revoked ones), and connections authenticated with a host certificate are not used. Default false (UpdateHostKeys yes in ssh_config turns it on through FromConfig(SshHostConfig); see ConfirmHostKeyUpdate for ask).

ForCurrentUser(StrictHostKeyChecking): The user's ~/.ssh/known_hosts and known_hosts2, plus the system-wide files, as ssh uses by default.

FromConfig(SshHostConfig): The files, policy and hashing from a resolved ssh_config (UserKnownHostsFile, GlobalKnownHostsFile, StrictHostKeyChecking, HashKnownHosts).

VerifyAsync(SshHostKeyContext, CancellationToken): Decides whether to trust the key in context.